EJS is not safe for user defined template. You shoud not use ejs as a user-defined template.
Payload:
<%= console.log(process.env); %>Run:
$ ejs ./template_file.ejs -o ./output.html
{
...Your environment variables
}ejs allow to run any JavaScript code in template by design.
If used incorrectly, It will cause RCE(Remote Code Execution) vulnerbility. It is not ejs problem, It is your application problem.